Read the docs

Chainlit

Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

Chainlit records in CISA KEV

No Chainlit vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Chainlit 2 records MEDIUM

Records

2 records in Chainlit · all components

TI-2026-17828 CVE-2026-22218 · GHSA-gm79-2pvc-wc75

Chainlit < 2.9.4 Arbitrary File Read via /project/element

Priority MEDIUM 64

Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.09724 Published 2026-01-19 Fixed in 2.9.4 CWE-22
TI-2026-17829 CVE-2026-22219 · GHSA-2g59-m95p-pgfq

Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element

Priority MEDIUM 50

Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.05174 Published 2026-01-19 Fixed in 2.9.4 CWE-918
Open these records in search →